From patchwork Thu Jun 4 09:02:26 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tomi Valkeinen X-Patchwork-Id: 6545951 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 83EEB9F326 for ; Thu, 4 Jun 2015 11:07:21 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 9180720713 for ; Thu, 4 Jun 2015 11:07:19 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 920582068E for ; Thu, 4 Jun 2015 11:07:18 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id C4DFE6EB08; Thu, 4 Jun 2015 04:06:50 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from devils.ext.ti.com (devils.ext.ti.com [198.47.26.153]) by gabe.freedesktop.org (Postfix) with ESMTP id C6AD76EADB for ; Thu, 4 Jun 2015 02:03:51 -0700 (PDT) Received: from dflxv15.itg.ti.com ([128.247.5.124]) by devils.ext.ti.com (8.13.7/8.13.7) with ESMTP id t5493mfj011145; Thu, 4 Jun 2015 04:03:48 -0500 Received: from DFLE72.ent.ti.com (dfle72.ent.ti.com [128.247.5.109]) by dflxv15.itg.ti.com (8.14.3/8.13.8) with ESMTP id t5493mtW029447; Thu, 4 Jun 2015 04:03:48 -0500 Received: from dlep33.itg.ti.com (157.170.170.75) by DFLE72.ent.ti.com (128.247.5.109) with Microsoft SMTP Server id 14.3.224.2; Thu, 4 Jun 2015 04:03:48 -0500 Received: from deskari.ti.com (ileax41-snat.itg.ti.com [10.172.224.153]) by dlep33.itg.ti.com (8.14.3/8.13.8) with ESMTP id t5493YwB014785; Thu, 4 Jun 2015 04:03:47 -0500 From: Tomi Valkeinen To: , Laurent Pinchart Subject: [PATCHv2 09/45] drm: omapdrm: Fix page flip race with CRTC disable Date: Thu, 4 Jun 2015 12:02:26 +0300 Message-ID: <1433408582-9828-10-git-send-email-tomi.valkeinen@ti.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1433408582-9828-1-git-send-email-tomi.valkeinen@ti.com> References: <1433408582-9828-1-git-send-email-tomi.valkeinen@ti.com> MIME-Version: 1.0 X-Mailman-Approved-At: Thu, 04 Jun 2015 04:06:34 -0700 Cc: Tomi Valkeinen X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Laurent Pinchart We can't rely on crtc->primary->fb in the page flip worker, as a racing CRTC disable (due for instance to an explicit framebuffer deletion from userspace) would set that field to NULL before the worker gets a change to run. Store the framebuffer queued for page flip in a new field of omap_crtc instead, and hold a reference to it. Signed-off-by: Laurent Pinchart Signed-off-by: Tomi Valkeinen --- drivers/gpu/drm/omapdrm/omap_crtc.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/omapdrm/omap_crtc.c b/drivers/gpu/drm/omapdrm/omap_crtc.c index 1076bc0a7f78..68abc4d7fa0d 100644 --- a/drivers/gpu/drm/omapdrm/omap_crtc.c +++ b/drivers/gpu/drm/omapdrm/omap_crtc.c @@ -66,7 +66,8 @@ struct omap_crtc { * page queue has been submitted, WAIT when waiting for GEM async * completion, QUEUED when the page flip has been queued to the hardware * or CANCELLED when the CRTC is turned off before the flip gets queued - * to the hardware. The flip event, if any, is stored in flip_event. The + * to the hardware. The flip event, if any, is stored in flip_event, and + * the framebuffer queued for page flip is stored in flip_fb. The * flip_wait wait queue is used to wait for page flip completion. * * The flip_work work queue handles page flip requests without caring @@ -76,6 +77,7 @@ struct omap_crtc { */ enum omap_page_flip_state flip_state; struct drm_pending_vblank_event *flip_event; + struct drm_framebuffer *flip_fb; wait_queue_head_t flip_wait; struct work_struct flip_work; @@ -630,6 +632,7 @@ static void page_flip_worker(struct work_struct *work) drm_modeset_lock(&crtc->mutex, NULL); spin_lock_irqsave(&dev->event_lock, flags); + /* * The page flip could have been cancelled while waiting for the GEM * async operation to complete. Don't queue the flip in that case. @@ -641,9 +644,11 @@ static void page_flip_worker(struct work_struct *work) omap_crtc->flip_state = OMAP_PAGE_FLIP_IDLE; queue_flip = false; } - spin_unlock_irqrestore(&dev->event_lock, flags); - fb = crtc->primary->fb; + fb = omap_crtc->flip_fb; + omap_crtc->flip_fb = NULL; + + spin_unlock_irqrestore(&dev->event_lock, flags); if (queue_flip) { omap_plane_mode_set(crtc->primary, crtc, fb, @@ -657,7 +662,7 @@ static void page_flip_worker(struct work_struct *work) bo = omap_framebuffer_bo(fb, 0); drm_gem_object_unreference_unlocked(bo); - drm_framebuffer_unreference(crtc->primary->fb); + drm_framebuffer_unreference(fb); } static void page_flip_cb(void *arg) @@ -692,10 +697,19 @@ static int omap_crtc_page_flip(struct drm_crtc *crtc, return -EBUSY; } + /* + * Store a reference to the framebuffer queued for page flip in the CRTC + * private structure. We can't rely on crtc->primary->fb in the page + * flip worker, as a racing CRTC disable (due for instance to an + * explicit framebuffer deletion from userspace) would set that field to + * NULL before the worker gets a change to run. + */ + drm_framebuffer_reference(fb); + omap_crtc->flip_fb = fb; omap_crtc->flip_event = event; omap_crtc->flip_state = OMAP_PAGE_FLIP_WAIT; + primary->fb = fb; - drm_framebuffer_reference(fb); spin_unlock_irqrestore(&dev->event_lock, flags);